<!DOCTYPE html>
<html lang="zh-CN">
    <head>
        <meta charset="utf-8">
        <meta name="viewport" content="width=device-width, initial-scale=1">
        <meta name="robots" content="noodp" />
        <meta http-equiv="X-UA-Compatible" content="IE=edge, chrome=1">
        <title>EFK日志平台部署 - 德国粗茶淡饭</title><meta name="Description" content="EFK日志平台部署"><meta property="og:title" content="EFK日志平台部署" />
<meta property="og:description" content="EFK日志平台部署" />
<meta property="og:type" content="article" />
<meta property="og:url" content="https://www.ctq6.cn/technology/logging/efk%E6%97%A5%E5%BF%97%E5%B9%B3%E5%8F%B0%E9%83%A8%E7%BD%B2/" />
<meta property="og:image" content="https://www.ctq6.cn/logo.png"/>
<meta property="article:published_time" content="2021-02-16T20:03:06+08:00" />
<meta property="article:modified_time" content="2021-02-16T20:03:06+08:00" />
<meta name="twitter:card" content="summary_large_image"/>
<meta name="twitter:image" content="https://www.ctq6.cn/logo.png"/>

<meta name="twitter:title" content="EFK日志平台部署"/>
<meta name="twitter:description" content="EFK日志平台部署"/>
<meta name="application-name" content="LoveIt">
<meta name="apple-mobile-web-app-title" content="LoveIt"><meta name="theme-color" content="#ffffff"><meta name="msapplication-TileColor" content="#da532c"><link rel="shortcut icon" type="image/x-icon" href="/favicon.ico" />
        <link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
        <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png"><link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png"><link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5"><link rel="manifest" href="/site.webmanifest"><link rel="canonical" href="https://www.ctq6.cn/technology/logging/efk%E6%97%A5%E5%BF%97%E5%B9%B3%E5%8F%B0%E9%83%A8%E7%BD%B2/" /><link rel="prev" href="https://www.ctq6.cn/technology/mongo/monogo%E5%89%AF%E6%9C%AC%E9%9B%86/" /><link rel="next" href="https://www.ctq6.cn/technology/ddbs/tidb%E4%BD%BF%E7%94%A8/" /><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/normalize.css@8.0.1/normalize.min.css"><link rel="stylesheet" href="/css/style.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@5.13.0/css/all.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/animate.css@3.7.2/animate.min.css"><script type="application/ld+json">
    {
        "@context": "http://schema.org",
        "@type": "BlogPosting",
        "headline": "EFK日志平台部署",
        "inLanguage": "zh-CN",
        "mainEntityOfPage": {
            "@type": "WebPage",
            "@id": "https:\/\/www.ctq6.cn\/technology\/logging\/efk%E6%97%A5%E5%BF%97%E5%B9%B3%E5%8F%B0%E9%83%A8%E7%BD%B2\/"
        },"image": [{
                            "@type": "ImageObject",
                            "url": "https:\/\/www.ctq6.cn\/images\/Apple-Devices-Preview.png",
                            "width":  3200 ,
                            "height":  2048 
                        }],"genre": "technology","keywords": "efk","wordcount":  4190 ,
        "url": "https:\/\/www.ctq6.cn\/technology\/logging\/efk%E6%97%A5%E5%BF%97%E5%B9%B3%E5%8F%B0%E9%83%A8%E7%BD%B2\/","datePublished": "2021-02-16T20:03:06+08:00","dateModified": "2021-02-16T20:03:06+08:00","license": "This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.","publisher": {
            "@type": "Organization",
            "name": "xxxx","logo": {
                    "@type": "ImageObject",
                    "url": "https:\/\/www.ctq6.cn\/images\/avatar.png",
                    "width":  528 ,
                    "height":  560 
                }},"author": {
                "@type": "Person",
                "name": "MikelPan"
            },"description": "EFK日志平台部署"
    }
    </script></head>
    <body header-desktop="fixed" header-mobile="auto"><script type="text/javascript">(window.localStorage && localStorage.getItem('theme') ? localStorage.getItem('theme') === 'dark' : ('auto' === 'auto' ? window.matchMedia('(prefers-color-scheme: dark)').matches : 'auto' === 'dark')) && document.body.setAttribute('theme', 'dark');</script>

        <div id="mask"></div><div class="wrapper"><header class="desktop" id="header-desktop">
    <div class="header-wrapper">
        <div class="header-title">
            <a href="/" title="德国粗茶淡饭"><span class="header-title-pre"><i class='far fa-kiss-wink-heart fa-fw'></i></span>德国粗茶淡饭</a>
        </div>
        <div class="menu">
            <div class="menu-inner"><a class="menu-item" href="/posts/"> 生活 </a><a class="menu-item" href="/technology/"> 技术 </a><a class="menu-item" href="/tags/"> 标签 </a><a class="menu-item" href="/categories/"> 分类 </a><a class="menu-item" href="/categories/documentation/"> 文档 </a><a class="menu-item" href="/about/"> 关于 </a><a class="menu-item" href="https://github.com/MikelPan/Cnblog.git" title="GitHub" rel="noopener noreffer" target="_blank"><i class='fab fa-github fa-fw'></i>  </a><span class="menu-item delimiter"></span><a href="javascript:void(0);" class="menu-item language" title="选择语言">简体中文<i class="fas fa-chevron-right fa-fw"></i>
                        <select class="language-select" id="language-select-desktop" onchange="location = this.value;"><option value="/technology/logging/efk%E6%97%A5%E5%BF%97%E5%B9%B3%E5%8F%B0%E9%83%A8%E7%BD%B2/" selected>简体中文</option></select>
                    </a><span class="menu-item search" id="search-desktop">
                        <input type="text" placeholder="搜索文章标题或内容..." id="search-input-desktop">
                        <a href="javascript:void(0);" class="search-button search-toggle" id="search-toggle-desktop" title="搜索">
                            <i class="fas fa-search fa-fw"></i>
                        </a>
                        <a href="javascript:void(0);" class="search-button search-clear" id="search-clear-desktop" title="清空">
                            <i class="fas fa-times-circle fa-fw"></i>
                        </a>
                        <span class="search-button search-loading" id="search-loading-desktop">
                            <i class="fas fa-spinner fa-fw fa-spin"></i>
                        </span>
                    </span><a href="javascript:void(0);" class="menu-item theme-switch" title="切换主题">
                    <i class="fas fa-adjust fa-fw"></i>
                </a>
            </div>
        </div>
    </div>
</header><header class="mobile" id="header-mobile">
    <div class="header-container">
        <div class="header-wrapper">
            <div class="header-title">
                <a href="/" title="德国粗茶淡饭"><span class="header-title-pre"><i class='far fa-kiss-wink-heart fa-fw'></i></span>德国粗茶淡饭</a>
            </div>
            <div class="menu-toggle" id="menu-toggle-mobile">
                <span></span><span></span><span></span>
            </div>
        </div>
        <div class="menu" id="menu-mobile"><div class="search-wrapper">
                    <div class="search mobile" id="search-mobile">
                        <input type="text" placeholder="搜索文章标题或内容..." id="search-input-mobile">
                        <a href="javascript:void(0);" class="search-button search-toggle" id="search-toggle-mobile" title="搜索">
                            <i class="fas fa-search fa-fw"></i>
                        </a>
                        <a href="javascript:void(0);" class="search-button search-clear" id="search-clear-mobile" title="清空">
                            <i class="fas fa-times-circle fa-fw"></i>
                        </a>
                        <span class="search-button search-loading" id="search-loading-mobile">
                            <i class="fas fa-spinner fa-fw fa-spin"></i>
                        </span>
                    </div>
                    <a href="javascript:void(0);" class="search-cancel" id="search-cancel-mobile">
                        取消
                    </a>
                </div><a class="menu-item" href="/posts/" title="">生活</a><a class="menu-item" href="/technology/" title="">技术</a><a class="menu-item" href="/tags/" title="">标签</a><a class="menu-item" href="/categories/" title="">分类</a><a class="menu-item" href="/categories/documentation/" title="">文档</a><a class="menu-item" href="/about/" title="">关于</a><a class="menu-item" href="https://github.com/MikelPan/Cnblog.git" title="GitHub" rel="noopener noreffer" target="_blank"><i class='fab fa-github fa-fw'></i></a><a href="javascript:void(0);" class="menu-item theme-switch" title="切换主题">
                <i class="fas fa-adjust fa-fw"></i>
            </a><a href="javascript:void(0);" class="menu-item" title="选择语言">简体中文<i class="fas fa-chevron-right fa-fw"></i>
                    <select class="language-select" onchange="location = this.value;"><option value="/technology/logging/efk%E6%97%A5%E5%BF%97%E5%B9%B3%E5%8F%B0%E9%83%A8%E7%BD%B2/" selected>简体中文</option></select>
                </a></div>
    </div>
</header>
<div class="search-dropdown desktop">
    <div id="search-dropdown-desktop"></div>
</div>
<div class="search-dropdown mobile">
    <div id="search-dropdown-mobile"></div>
</div>
<main class="main">
                <div class="container"><div class="page single special"><h1 class="single-title animated pulse faster">EFK日志平台部署</h1><div class="content" id="content"><h3 id="efk-架构说明">EFK 架构说明</h3>
<p>日志收集方案是采用 Elasticsearch、Fluentd、Filebeat 和 Kibana（EFK）技术栈。
Fluented主要用来收集k8s组件和docker容器日志，Filebeat主要用来收集应用日志，主要因为目前项目中应用日志并未全部通过stdout方式输出到docker日志驱动中，导致flunted收集日志并不全面，需要通过Filebeat来将应用日志收集到es中，再由kibana来展示。</p>
<p>Elasticsearch 是一个实时的、分布式的可扩展的搜索引擎，允许进行全文、结构化搜索，它通常用于索引和搜索大量日志数据，也可用于搜索许多不同类型的文档。</p>
<p>Elasticsearch 通常与 Kibana 一起部署，Kibana 是 Elasticsearch 的一个功能强大的数据可视化 Dashboard，Kibana 允许你通过 web 界面来浏览 Elasticsearch 日志数据。</p>
<p>Fluentd是一个流行的开源数据收集器，我们将在 Kubernetes 集群节点上安装 Fluentd，通过获取容器日志文件、过滤和转换日志数据，然后将数据传递到 Elasticsearch 集群，在该集群中对其进行索引和存储。</p>
<p>Filebeat 内置有多种模块（auditd、Apache、NGINX、System、MySQL 等等），可针对常见格式的日志大大简化收集、解析和可视化过程，只需一条命令即可。之所以能实现这一点，是因为它将自动默认路径（因操作系统而异）与 Elasticsearch 采集节点管道的定义和 Kibana 仪表板组合在一起。不仅如此，数个 Filebeat 模块还包括预配置的 Machine Learning 任务。</p>
<p>将官方提供的yaml下载到本地，如EFK目录下
<a href="https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/fluentd-elasticsearch">https://github.com/kubernetes/kubernetes/tree/master/cluster/addons/fluentd-elasticsearch</a></p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash">wget  <span class="se">\
</span><span class="se"></span>https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/es-statefulset.yaml
wget  <span class="se">\
</span><span class="se"></span>https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/es-service.yaml
wget  <span class="se">\
</span><span class="se"></span>https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/fluentd-es-configmap.yaml
wget  <span class="se">\
</span><span class="se"></span>https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/fluentd-es-ds.yaml
wget  <span class="se">\
</span><span class="se"></span>https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/kibana-service.yaml
wget  <span class="se">\
</span><span class="se"></span>https://raw.githubusercontent.com/kubernetes/kubernetes/master/cluster/addons/fluentd-elasticsearch/kibana-deployment.yaml
</code></pre></td></tr></table>
</div>
</div><p>下载filebeat官方提供的yaml文件到本地目录下如EFK
<a href="https://github.com/elastic/beats/blob/master/deploy/kubernetes/filebeat-kubernetes.yaml">https://github.com/elastic/beats/blob/master/deploy/kubernetes/filebeat-kubernetes.yaml</a></p>
<h3 id="efk-部署">EFK 部署</h3>
<h4 id="创建-elasticsearch-集群">创建 Elasticsearch 集群</h4>
<p>在创建 Elasticsearch 集群之前，先创建一个命名空间，我们将在其中安装所有日志相关的资源对象。
新建一个 kube-logging_ns.yaml 文件：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">v1</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">Namespace</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><p>然后通过 kubectl 创建该资源清单，创建一个名为 logging 的 namespace：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash"><span class="c1"># kubectl get ns</span>
NAME                       STATUS   AGE
default                    Active   115d
kube-node-lease            Active   115d
kube-public                Active   115d
kube-system                Active   115d
logging                    Active   62d
</code></pre></td></tr></table>
</div>
</div><p>修改定义 Pod 模板部分内容,添加java_opts环境变量</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash">        env:
        - name: <span class="s2">&#34;NAMESPACE&#34;</span>
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
        - name: ES_JAVA_OPTS
          value: <span class="s2">&#34;-Xms512m -Xmx512m&#34;</span>
</code></pre></td></tr></table>
</div>
</div><p>该部分是定义 StatefulSet 中的 Pod，我们这里使用一个-oss后缀的镜像，该镜像是 Elasticsearch 的开源版本，如果你想使用包含X-Pack之类的版本，可以去掉该后缀。然后暴露了9200和9300两个端口，注意名称要和上面定义的 Service 保持一致。然后通过 volumeMount 声明了数据持久化目录，下面我们再来定义 VolumeClaims。最后就是我们在容器中设置的一些环境变量了：</p>
<ul>
<li>ES_JAVA_OPTS：这里我们设置为-Xms512m -Xmx512m，告诉JVM使用512 MB的最小和最大堆。</li>
</ul>
<p>接下来添加关于 initContainer 的内容</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash">      initContainers:
      - name: fix-permissions
        image: busybox
        command: <span class="o">[</span><span class="s2">&#34;sh&#34;</span>, <span class="s2">&#34;-c&#34;</span>, <span class="s2">&#34;chown -R 1000:1000 /usr/share/elasticsearch/data&#34;</span><span class="o">]</span>
        securityContext:
          privileged: <span class="nb">true</span>
        volumeMounts:
        - name: data
          mountPath: /usr/share/elasticsearch/data
      - name: elasticsearch-logging-init
        image: alpine:3.6
        command: <span class="o">[</span><span class="s2">&#34;/sbin/sysctl&#34;</span>, <span class="s2">&#34;-w&#34;</span>, <span class="s2">&#34;vm.max_map_count=262144&#34;</span><span class="o">]</span>
        securityContext:
          privileged: <span class="nb">true</span>
      - name: increase-fd-ulimit
        image: busybox
        command: <span class="o">[</span><span class="s2">&#34;sh&#34;</span>, <span class="s2">&#34;-c&#34;</span>, <span class="s2">&#34;ulimit -n 65536&#34;</span><span class="o">]</span>
        securityContext:
          privileged: <span class="nb">true</span>
                           
</code></pre></td></tr></table>
</div>
</div><p>这里定义了几个在主应用程序之前运行的 Init 容器，这些初始容器按照定义的顺序依次执行，执行完成后才会启动主应用容器。</p>
<p>第一个名为 fix-permissions 的容器用来运行 chown 命令，将 Elasticsearch 数据目录的用户和组更改为1000:1000（Elasticsearch 用户的 UID）。因为默认情况下，Kubernetes 用 root 用户挂载数据目录，这会使得 Elasticsearch 无法方法该数据目录，可以参考 Elasticsearch 生产中的一些默认注意事项相关文档说明：https://www.elastic.co/guide/en/elasticsearch/reference/current/docker.html#_notes_for_production_use_and_defaults。</p>
<p>第二个名为 elasticsearch-logging-init 的容器用来增加操作系统对mmap计数的限制，默认情况下该值可能太低，导致内存不足的错误，要了解更多关于该设置的信息，可以查看 Elasticsearch 官方文档说明：https://www.elastic.co/guide/en/elasticsearch/reference/current/vm-max-map-count.html。</p>
<p>最后一个初始化容器是用来执行ulimit命令增加打开文件描述符的最大数量的。</p>
<p>修改数据目录持久化</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash">        volumeMounts:
        - name: elasticsearch-logging
          mountPath: /usr/share/elasticsearch/data
      volumes:
      - name: elasticsearch-logging
        hostPath:
          path: /data/elasticsearch-logs/data
</code></pre></td></tr></table>
</div>
</div><p>通过hostPath模式将es数据持久化到宿主机上。</p>
<p>完整的配置文件如下：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">  1
</span><span class="lnt">  2
</span><span class="lnt">  3
</span><span class="lnt">  4
</span><span class="lnt">  5
</span><span class="lnt">  6
</span><span class="lnt">  7
</span><span class="lnt">  8
</span><span class="lnt">  9
</span><span class="lnt"> 10
</span><span class="lnt"> 11
</span><span class="lnt"> 12
</span><span class="lnt"> 13
</span><span class="lnt"> 14
</span><span class="lnt"> 15
</span><span class="lnt"> 16
</span><span class="lnt"> 17
</span><span class="lnt"> 18
</span><span class="lnt"> 19
</span><span class="lnt"> 20
</span><span class="lnt"> 21
</span><span class="lnt"> 22
</span><span class="lnt"> 23
</span><span class="lnt"> 24
</span><span class="lnt"> 25
</span><span class="lnt"> 26
</span><span class="lnt"> 27
</span><span class="lnt"> 28
</span><span class="lnt"> 29
</span><span class="lnt"> 30
</span><span class="lnt"> 31
</span><span class="lnt"> 32
</span><span class="lnt"> 33
</span><span class="lnt"> 34
</span><span class="lnt"> 35
</span><span class="lnt"> 36
</span><span class="lnt"> 37
</span><span class="lnt"> 38
</span><span class="lnt"> 39
</span><span class="lnt"> 40
</span><span class="lnt"> 41
</span><span class="lnt"> 42
</span><span class="lnt"> 43
</span><span class="lnt"> 44
</span><span class="lnt"> 45
</span><span class="lnt"> 46
</span><span class="lnt"> 47
</span><span class="lnt"> 48
</span><span class="lnt"> 49
</span><span class="lnt"> 50
</span><span class="lnt"> 51
</span><span class="lnt"> 52
</span><span class="lnt"> 53
</span><span class="lnt"> 54
</span><span class="lnt"> 55
</span><span class="lnt"> 56
</span><span class="lnt"> 57
</span><span class="lnt"> 58
</span><span class="lnt"> 59
</span><span class="lnt"> 60
</span><span class="lnt"> 61
</span><span class="lnt"> 62
</span><span class="lnt"> 63
</span><span class="lnt"> 64
</span><span class="lnt"> 65
</span><span class="lnt"> 66
</span><span class="lnt"> 67
</span><span class="lnt"> 68
</span><span class="lnt"> 69
</span><span class="lnt"> 70
</span><span class="lnt"> 71
</span><span class="lnt"> 72
</span><span class="lnt"> 73
</span><span class="lnt"> 74
</span><span class="lnt"> 75
</span><span class="lnt"> 76
</span><span class="lnt"> 77
</span><span class="lnt"> 78
</span><span class="lnt"> 79
</span><span class="lnt"> 80
</span><span class="lnt"> 81
</span><span class="lnt"> 82
</span><span class="lnt"> 83
</span><span class="lnt"> 84
</span><span class="lnt"> 85
</span><span class="lnt"> 86
</span><span class="lnt"> 87
</span><span class="lnt"> 88
</span><span class="lnt"> 89
</span><span class="lnt"> 90
</span><span class="lnt"> 91
</span><span class="lnt"> 92
</span><span class="lnt"> 93
</span><span class="lnt"> 94
</span><span class="lnt"> 95
</span><span class="lnt"> 96
</span><span class="lnt"> 97
</span><span class="lnt"> 98
</span><span class="lnt"> 99
</span><span class="lnt">100
</span><span class="lnt">101
</span><span class="lnt">102
</span><span class="lnt">103
</span><span class="lnt">104
</span><span class="lnt">105
</span><span class="lnt">106
</span><span class="lnt">107
</span><span class="lnt">108
</span><span class="lnt">109
</span><span class="lnt">110
</span><span class="lnt">111
</span><span class="lnt">112
</span><span class="lnt">113
</span><span class="lnt">114
</span><span class="lnt">115
</span><span class="lnt">116
</span><span class="lnt">117
</span><span class="lnt">118
</span><span class="lnt">119
</span><span class="lnt">120
</span><span class="lnt">121
</span><span class="lnt">122
</span><span class="lnt">123
</span><span class="lnt">124
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="c"># RBAC authn and authz</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">v1</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ServiceAccount</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nn">---</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ClusterRole</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">rbac.authorization.k8s.io/v1</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nt">rules</span><span class="p">:</span><span class="w">
</span><span class="w"></span>- <span class="nt">apiGroups</span><span class="p">:</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;&#34;</span><span class="w">
</span><span class="w">  </span><span class="nt">resources</span><span class="p">:</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;services&#34;</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;namespaces&#34;</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;endpoints&#34;</span><span class="w">
</span><span class="w">  </span><span class="nt">verbs</span><span class="p">:</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;get&#34;</span><span class="w">
</span><span class="w"></span><span class="nn">---</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ClusterRoleBinding</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">rbac.authorization.k8s.io/v1</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nt">subjects</span><span class="p">:</span><span class="w">
</span><span class="w"></span>- <span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ServiceAccount</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span><span class="w">  </span><span class="nt">apiGroup</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;&#34;</span><span class="w">
</span><span class="w"></span><span class="nt">roleRef</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ClusterRole</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">  </span><span class="nt">apiGroup</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;&#34;</span><span class="w">
</span><span class="w"></span><span class="nn">---</span><span class="w">
</span><span class="w"></span><span class="c"># Elasticsearch deployment itself</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">apps/v1</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">StatefulSet</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">    </span><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="l">v7.2.0</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nt">spec</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">serviceName</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">  </span><span class="nt">replicas</span><span class="p">:</span><span class="w"> </span><span class="m">1</span><span class="w">
</span><span class="w">  </span><span class="nt">selector</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">matchLabels</span><span class="p">:</span><span class="w">
</span><span class="w">      </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">      </span><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="l">v7.2.0</span><span class="w">
</span><span class="w">  </span><span class="nt">template</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">      </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">        </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">        </span><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="l">v7.2.0</span><span class="w">
</span><span class="w">    </span><span class="nt">spec</span><span class="p">:</span><span class="w">
</span><span class="w">      </span><span class="nt">serviceAccountName</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">      </span><span class="nt">containers</span><span class="p">:</span><span class="w">
</span><span class="w">      </span>- <span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l">quay.io/fluentd_elasticsearch/elasticsearch:v7.2.0</span><span class="w">
</span><span class="w">        </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging</span><span class="w">
</span><span class="w">        </span><span class="nt">imagePullPolicy</span><span class="p">:</span><span class="w"> </span><span class="l">IfNotPresent</span><span class="w">
</span><span class="w">        </span><span class="nt">resources</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="c"># need more cpu upon initialization, therefore burstable class</span><span class="w">
</span><span class="w">          </span><span class="nt">limits</span><span class="p">:</span><span class="w">
</span><span class="w">            </span><span class="nt">cpu</span><span class="p">:</span><span class="w"> </span><span class="l">1000m</span><span class="w">
</span><span class="w">          </span><span class="nt">requests</span><span class="p">:</span><span class="w">
</span><span class="w">            </span><span class="nt">cpu</span><span class="p">:</span><span class="w"> </span><span class="l">100m</span><span class="w">
</span><span class="w">        </span><span class="nt">ports</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">containerPort</span><span class="p">:</span><span class="w"> </span><span class="m">9200</span><span class="w">
</span><span class="w">          </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">db</span><span class="w">
</span><span class="w">          </span><span class="nt">protocol</span><span class="p">:</span><span class="w"> </span><span class="l">TCP</span><span class="w">
</span><span class="w">        </span>- <span class="nt">containerPort</span><span class="p">:</span><span class="w"> </span><span class="m">9300</span><span class="w">
</span><span class="w">          </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">transport</span><span class="w">
</span><span class="w">          </span><span class="nt">protocol</span><span class="p">:</span><span class="w"> </span><span class="l">TCP</span><span class="w">
</span><span class="w">        </span><span class="nt">volumeMounts</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">data</span><span class="w">
</span><span class="w">          </span><span class="nt">mountPath</span><span class="p">:</span><span class="w"> </span><span class="l">/usr/share/elasticsearch/data</span><span class="w">
</span><span class="w">        </span><span class="nt">env</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">ES_JAVA_OPTS</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;-Xms512m -Xmx512m&#34;</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">TZ</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w"> </span><span class="l">Asia/Shanghai</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;NAMESPACE&#34;</span><span class="w">
</span><span class="w">          </span><span class="nt">valueFrom</span><span class="p">:</span><span class="w">
</span><span class="w">            </span><span class="nt">fieldRef</span><span class="p">:</span><span class="w">
</span><span class="w">              </span><span class="nt">fieldPath</span><span class="p">:</span><span class="w"> </span><span class="l">metadata.namespace</span><span class="w">
</span><span class="w">      </span><span class="nt">volumes</span><span class="p">:</span><span class="w">
</span><span class="w">      </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">data</span><span class="w">
</span><span class="w">        </span><span class="nt">hostPath</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">path</span><span class="p">:</span><span class="w"> </span><span class="l">/data/elasticsearch-logs/data</span><span class="w">
</span><span class="w">      </span><span class="c"># Elasticsearch requires vm.max_map_count to be at least 262144.</span><span class="w">
</span><span class="w">      </span><span class="c"># If your OS already sets up this number to a higher value, feel free</span><span class="w">
</span><span class="w">      </span><span class="c"># to remove this init container.</span><span class="w">
</span><span class="w">      </span><span class="nt">initContainers</span><span class="p">:</span><span class="w">
</span><span class="w">      </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fix-permissions</span><span class="w">
</span><span class="w">        </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l">busybox</span><span class="w">
</span><span class="w">        </span><span class="nt">command</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">&#34;sh&#34;</span><span class="p">,</span><span class="w"> </span><span class="s2">&#34;-c&#34;</span><span class="p">,</span><span class="w"> </span><span class="s2">&#34;chown -R 1000:1000 /usr/share/elasticsearch/data&#34;</span><span class="p">]</span><span class="w">
</span><span class="w">        </span><span class="nt">securityContext</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">privileged</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span><span class="w">        </span><span class="nt">volumeMounts</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">data</span><span class="w">
</span><span class="w">          </span><span class="nt">mountPath</span><span class="p">:</span><span class="w"> </span><span class="l">/usr/share/elasticsearch/data</span><span class="w">
</span><span class="w">      </span>- <span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l">alpine:3.6</span><span class="w">
</span><span class="w">        </span><span class="nt">command</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">&#34;/sbin/sysctl&#34;</span><span class="p">,</span><span class="w"> </span><span class="s2">&#34;-w&#34;</span><span class="p">,</span><span class="w"> </span><span class="s2">&#34;vm.max_map_count=262144&#34;</span><span class="p">]</span><span class="w">
</span><span class="w">        </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">elasticsearch-logging-init</span><span class="w">
</span><span class="w">        </span><span class="nt">securityContext</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">privileged</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span><span class="w">      </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">increase-fd-ulimit</span><span class="w">
</span><span class="w">        </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l">busybox</span><span class="w">
</span><span class="w">        </span><span class="nt">command</span><span class="p">:</span><span class="w"> </span><span class="p">[</span><span class="s2">&#34;sh&#34;</span><span class="p">,</span><span class="w"> </span><span class="s2">&#34;-c&#34;</span><span class="p">,</span><span class="w"> </span><span class="s2">&#34;ulimit -n 65536&#34;</span><span class="p">]</span><span class="w">
</span><span class="w">        </span><span class="nt">securityContext</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">privileged</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><h4 id="创建-kibana-服务">创建 Kibana 服务</h4>
<p>修改kibana-deployment.yaml文件将服务认证注释掉</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="w">         </span><span class="c"># - name: SERVER_BASEPATH</span><span class="w">
</span><span class="w">            </span><span class="nt">value</span><span class="p">:</span><span class="w"> </span><span class="l">/api/v1/namespaces/kube-system/services/kibana-logging/proxy</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><p>修改server为Noport模式暴露出来</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span><span class="lnt">3
</span><span class="lnt">4
</span><span class="lnt">5
</span><span class="lnt">6
</span><span class="lnt">7
</span><span class="lnt">8
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="nt">spec</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">type</span><span class="p">:</span><span class="w"> </span><span class="l">NodePort</span><span class="w">
</span><span class="w">  </span><span class="nt">ports</span><span class="p">:</span><span class="w">
</span><span class="w">  </span>- <span class="nt">port</span><span class="p">:</span><span class="w"> </span><span class="m">5601</span><span class="w">
</span><span class="w">    </span><span class="nt">protocol</span><span class="p">:</span><span class="w"> </span><span class="l">TCP</span><span class="w">
</span><span class="w">    </span><span class="nt">targetPort</span><span class="p">:</span><span class="w"> </span><span class="l">ui</span><span class="w">
</span><span class="w">    </span><span class="nt">nodePort</span><span class="p">:</span><span class="w"> </span><span class="m">32617</span><span class="w">
</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><p>启动服务</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash">kubectl apply -f kibana-deployment.yaml kibana-service.yaml
</code></pre></td></tr></table>
</div>
</div><p>安装完成后直接通过IP+端口方式访问kibana面板</p>
<h4 id="安装fluented服务">安装fluented服务</h4>
<h5 id="工作原理">工作原理</h5>
<p>Fluentd 通过一组给定的数据源抓取日志数据，处理后（转换成结构化的数据格式）将它们转发给其他服务，比如 Elasticsearch、对象存储等等。Fluentd 支持超过300个日志存储和分析服务，所以在这方面是非常灵活的。主要运行步骤如下：</p>
<ul>
<li>首先 Fluentd 从多个日志源获取数据</li>
<li>结构化并且标记这些数据</li>
<li>然后根据匹配的标签将数据发送到多个目标服务去</li>
</ul>
<p><em>日志源配置</em>
收集 Kubernetes 节点上的所有容器日志，就需要做如下的日志源配置</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="l">&lt;source&gt;</span><span class="w">
</span><span class="w">
</span><span class="w"></span>@<span class="l">id fluentd-containers.log</span><span class="w">
</span><span class="w">
</span><span class="w"></span>@<span class="l">type tail</span><span class="w">
</span><span class="w">
</span><span class="w"></span><span class="l">path /var/log/containers/*.log</span><span class="w">
</span><span class="w">
</span><span class="w"></span><span class="l">pos_file /var/log/fluentd-containers.log.pos</span><span class="w">
</span><span class="w">
</span><span class="w"></span><span class="l">time_format %Y-%m-%dT%H:%M:%S.%NZ</span><span class="w">
</span><span class="w">
</span><span class="w"></span><span class="l">tag raw.kubernetes.*</span><span class="w">
</span><span class="w">
</span><span class="w"></span><span class="l">format json</span><span class="w">
</span><span class="w">
</span><span class="w"></span><span class="l">read_from_head true</span><span class="w">
</span><span class="w">
</span><span class="w"></span><span class="l">&lt;/source&gt;</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><p>上面配置部分参数说明如下：</p>
<ul>
<li>id：表示引用该日志源的唯一标识符，该标识可用于进一步过滤和路由结构化日志数据</li>
<li>type：Fluentd 内置的指令，tail表示 Fluentd 从上次读取的位置通过 tail 不断获取数据，另外一个是http表示通过一个 GET 请求来收集数据。</li>
<li>path：tail类型下的特定参数，告诉 Fluentd 采集/var/log/containers目录下的所有日志，这是 docker 在 Kubernetes 节点上用来存储运行容器 stdout 输出日志数据的目录。</li>
<li>pos_file：检查点，如果 Fluentd 程序重新启动了，它将使用此文件中的位置来恢复日志数据收集。</li>
<li>tag：用来将日志源与目标或者过滤器匹配的自定义字符串，Fluentd 匹配源/目标标签来路由日志数据。</li>
</ul>
<p><em>路由配置</em>
上面是日志源的配置，接下来看看如何将日志数据发送到 Elasticsearch：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span><span class="lnt">21
</span><span class="lnt">22
</span><span class="lnt">23
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="w">    </span><span class="l">&lt;match **&gt;</span><span class="w">
</span><span class="w">      </span>@<span class="l">id elasticsearch</span><span class="w">
</span><span class="w">      </span>@<span class="l">type elasticsearch</span><span class="w">
</span><span class="w">      </span>@<span class="l">log_level info</span><span class="w">
</span><span class="w">      </span><span class="l">type_name _doc</span><span class="w">
</span><span class="w">      </span><span class="l">include_tag_key true</span><span class="w">
</span><span class="w">      </span><span class="l">host elasticsearch-logging</span><span class="w">
</span><span class="w">      </span><span class="l">port 9200</span><span class="w">
</span><span class="w">      </span><span class="l">logstash_format true</span><span class="w">
</span><span class="w">      </span><span class="l">&lt;buffer&gt;</span><span class="w">
</span><span class="w">        </span>@<span class="l">type file</span><span class="w">
</span><span class="w">        </span><span class="l">path /var/log/fluentd-buffers/kubernetes.system.buffer</span><span class="w">
</span><span class="w">        </span><span class="l">flush_mode interval</span><span class="w">
</span><span class="w">        </span><span class="l">retry_type exponential_backoff</span><span class="w">
</span><span class="w">        </span><span class="l">flush_thread_count 2</span><span class="w">
</span><span class="w">        </span><span class="l">flush_interval 5s</span><span class="w">
</span><span class="w">        </span><span class="l">retry_forever</span><span class="w">
</span><span class="w">        </span><span class="l">retry_max_interval 30</span><span class="w">
</span><span class="w">        </span><span class="l">chunk_limit_size 2M</span><span class="w">
</span><span class="w">        </span><span class="l">queue_limit_length 8</span><span class="w">
</span><span class="w">        </span><span class="l">overflow_action block</span><span class="w">
</span><span class="w">      </span><span class="l">&lt;/buffer&gt;</span><span class="w">
</span><span class="w">    </span><span class="l">&lt;/match&gt;</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><ul>
<li>match：标识一个目标标签，后面是一个匹配日志源的正则表达式，这里想要捕获所有的日志并将它们发送给 Elasticsearch，所以需要配置成**。</li>
<li>id：目标的一个唯一标识符。</li>
<li>type：支持的输出插件标识符，这里要输出到 Elasticsearch，所以配置成 elasticsearch，这是 Fluentd 的一个内置插件。</li>
<li>log_level：指定要捕获的日志级别，这里配置成info，表示任何该级别或者该级别以上（INFO、WARNING、ERROR）的日志都将被路由到 Elsasticsearch。</li>
<li>host/port：定义 Elasticsearch 的地址，也可以配置认证信息，我们的 Elasticsearch 不需要认证，所以这里直接指定 host 和 port 即可。</li>
<li>logstash_format：Elasticsearch 服务对日志数据构建反向索引进行搜索，将 logstash_format 设置为true，Fluentd 将会以 logstash 格式来转发结构化的日志数据。</li>
<li>Buffer： Fluentd 允许在目标不可用时进行缓存，比如，如果网络出现故障或者 Elasticsearch 不可用的时候。缓冲区配置也有助于降低磁盘的 IO。</li>
</ul>
<h5 id="安装fluented">安装fluented</h5>
<p>要收集 Kubernetes 集群的日志，直接用 DasemonSet 控制器来部署 Fluentd 应用，这样，它就可以从 Kubernetes 节点上采集日志，确保在集群中的每个节点上始终运行一个 Fluentd 容器。</p>
<p>首先，通过 ConfigMap 对象来指定 Fluentd 配置文件，新建 fluentd-configmap.yaml 文件，文件内容如下：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span><span class="lnt">21
</span><span class="lnt">22
</span><span class="lnt">23
</span><span class="lnt">24
</span><span class="lnt">25
</span><span class="lnt">26
</span><span class="lnt">27
</span><span class="lnt">28
</span><span class="lnt">29
</span><span class="lnt">30
</span><span class="lnt">31
</span><span class="lnt">32
</span><span class="lnt">33
</span><span class="lnt">34
</span><span class="lnt">35
</span><span class="lnt">36
</span><span class="lnt">37
</span><span class="lnt">38
</span><span class="lnt">39
</span><span class="lnt">40
</span><span class="lnt">41
</span><span class="lnt">42
</span><span class="lnt">43
</span><span class="lnt">44
</span><span class="lnt">45
</span><span class="lnt">46
</span><span class="lnt">47
</span><span class="lnt">48
</span><span class="lnt">49
</span><span class="lnt">50
</span><span class="lnt">51
</span><span class="lnt">52
</span><span class="lnt">53
</span><span class="lnt">54
</span><span class="lnt">55
</span><span class="lnt">56
</span><span class="lnt">57
</span><span class="lnt">58
</span><span class="lnt">59
</span><span class="lnt">60
</span><span class="lnt">61
</span><span class="lnt">62
</span><span class="lnt">63
</span><span class="lnt">64
</span><span class="lnt">65
</span><span class="lnt">66
</span><span class="lnt">67
</span><span class="lnt">68
</span><span class="lnt">69
</span><span class="lnt">70
</span><span class="lnt">71
</span><span class="lnt">72
</span><span class="lnt">73
</span><span class="lnt">74
</span><span class="lnt">75
</span><span class="lnt">76
</span><span class="lnt">77
</span><span class="lnt">78
</span><span class="lnt">79
</span><span class="lnt">80
</span><span class="lnt">81
</span><span class="lnt">82
</span><span class="lnt">83
</span><span class="lnt">84
</span><span class="lnt">85
</span><span class="lnt">86
</span><span class="lnt">87
</span><span class="lnt">88
</span><span class="lnt">89
</span><span class="lnt">90
</span><span class="lnt">91
</span><span class="lnt">92
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ConfigMap</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">v1</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es-config-v0.2.0</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">kube-system</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nt">data</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">system.conf</span><span class="p">:</span><span class="w"> </span><span class="p">|-</span><span class="sd">
</span><span class="sd">    &lt;system&gt;
</span><span class="sd">      root_dir /tmp/fluentd-buffers/
</span><span class="sd">    &lt;/system&gt;</span><span class="w">    
</span><span class="w">  </span><span class="nt">containers.input.conf</span><span class="p">:</span><span class="w"> </span><span class="p">|-</span><span class="sd">
</span><span class="sd">    &lt;source&gt;
</span><span class="sd">      @id fluentd-containers.log
</span><span class="sd">      @type tail
</span><span class="sd">      path /var/log/containers/*.log
</span><span class="sd">      pos_file /var/log/es-containers.log.pos
</span><span class="sd">      time_format %Y-%m-%dT%H:%M:%S.%NZ
</span><span class="sd">      localtime
</span><span class="sd">      tag raw.kubernetes.*
</span><span class="sd">      format json
</span><span class="sd">      read_from_head true
</span><span class="sd">    &lt;/source&gt;
</span><span class="sd">    # Detect exceptions in the log output and forward them as one log entry.
</span><span class="sd">    &lt;match raw.kubernetes.**&gt;
</span><span class="sd">      @id raw.kubernetes
</span><span class="sd">      @type detect_exceptions
</span><span class="sd">      remove_tag_prefix raw
</span><span class="sd">      message log
</span><span class="sd">      stream stream
</span><span class="sd">      multiline_flush_interval 5
</span><span class="sd">      max_bytes 500000
</span><span class="sd">      max_lines 1000
</span><span class="sd">    &lt;/match&gt;
</span><span class="sd">    system.input.conf: |-
</span><span class="sd">    # Logs from systemd-journal for interesting services.
</span><span class="sd">    &lt;source&gt;
</span><span class="sd">      @id journald-docker
</span><span class="sd">      @type systemd
</span><span class="sd">      filters [{ &#34;_SYSTEMD_UNIT&#34;: &#34;docker.service&#34; }]
</span><span class="sd">      &lt;storage&gt;
</span><span class="sd">        @type local
</span><span class="sd">        persistent true
</span><span class="sd">      &lt;/storage&gt;
</span><span class="sd">      read_from_head true
</span><span class="sd">      tag docker
</span><span class="sd">    &lt;/source&gt;
</span><span class="sd">    &lt;source&gt;
</span><span class="sd">      @id journald-kubelet
</span><span class="sd">      @type systemd
</span><span class="sd">      filters [{ &#34;_SYSTEMD_UNIT&#34;: &#34;kubelet.service&#34; }]
</span><span class="sd">      &lt;storage&gt;
</span><span class="sd">        @type local
</span><span class="sd">        persistent true
</span><span class="sd">      &lt;/storage&gt;
</span><span class="sd">      read_from_head true
</span><span class="sd">      tag kubelet
</span><span class="sd">    &lt;/source&gt;</span><span class="w">    
</span><span class="w">  </span><span class="nt">forward.input.conf</span><span class="p">:</span><span class="w"> </span><span class="p">|-</span><span class="sd">
</span><span class="sd">    # Takes the messages sent over TCP
</span><span class="sd">    &lt;source&gt;
</span><span class="sd">      @type forward
</span><span class="sd">    &lt;/source&gt;</span><span class="w">    
</span><span class="w">  </span><span class="nt">output.conf</span><span class="p">:</span><span class="w"> </span><span class="p">|-</span><span class="sd">
</span><span class="sd">    # Enriches records with Kubernetes metadata
</span><span class="sd">    &lt;filter kubernetes.**&gt;
</span><span class="sd">      @type kubernetes_metadata
</span><span class="sd">    &lt;/filter&gt;
</span><span class="sd">    &lt;match **&gt;
</span><span class="sd">      @id elasticsearch
</span><span class="sd">      @type elasticsearch
</span><span class="sd">      @log_level info
</span><span class="sd">      include_tag_key true
</span><span class="sd">      host elasticsearch
</span><span class="sd">      port 9200
</span><span class="sd">      logstash_format true
</span><span class="sd">      request_timeout    30s
</span><span class="sd">      &lt;buffer&gt;
</span><span class="sd">        @type file
</span><span class="sd">        path /var/log/fluentd-buffers/kubernetes.system.buffer
</span><span class="sd">        flush_mode interval
</span><span class="sd">        retry_type exponential_backoff
</span><span class="sd">        flush_thread_count 2
</span><span class="sd">        flush_interval 5s
</span><span class="sd">        retry_forever
</span><span class="sd">        retry_max_interval 30
</span><span class="sd">        chunk_limit_size 2M
</span><span class="sd">        queue_limit_length 8
</span><span class="sd">        overflow_action block
</span><span class="sd">      &lt;/buffer&gt;
</span><span class="sd">    &lt;/match&gt;</span><span class="w">    
</span></code></pre></td></tr></table>
</div>
</div><p>上面配置文件中配置了 docker 容器日志目录以及 docker、kubelet 应用的日志的收集，收集到数据经过处理后发送到 elasticsearch:9200 服务</p>
<p>新建一个 fluentd-daemonset.yaml 的文件，文件内容如下：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">  1
</span><span class="lnt">  2
</span><span class="lnt">  3
</span><span class="lnt">  4
</span><span class="lnt">  5
</span><span class="lnt">  6
</span><span class="lnt">  7
</span><span class="lnt">  8
</span><span class="lnt">  9
</span><span class="lnt"> 10
</span><span class="lnt"> 11
</span><span class="lnt"> 12
</span><span class="lnt"> 13
</span><span class="lnt"> 14
</span><span class="lnt"> 15
</span><span class="lnt"> 16
</span><span class="lnt"> 17
</span><span class="lnt"> 18
</span><span class="lnt"> 19
</span><span class="lnt"> 20
</span><span class="lnt"> 21
</span><span class="lnt"> 22
</span><span class="lnt"> 23
</span><span class="lnt"> 24
</span><span class="lnt"> 25
</span><span class="lnt"> 26
</span><span class="lnt"> 27
</span><span class="lnt"> 28
</span><span class="lnt"> 29
</span><span class="lnt"> 30
</span><span class="lnt"> 31
</span><span class="lnt"> 32
</span><span class="lnt"> 33
</span><span class="lnt"> 34
</span><span class="lnt"> 35
</span><span class="lnt"> 36
</span><span class="lnt"> 37
</span><span class="lnt"> 38
</span><span class="lnt"> 39
</span><span class="lnt"> 40
</span><span class="lnt"> 41
</span><span class="lnt"> 42
</span><span class="lnt"> 43
</span><span class="lnt"> 44
</span><span class="lnt"> 45
</span><span class="lnt"> 46
</span><span class="lnt"> 47
</span><span class="lnt"> 48
</span><span class="lnt"> 49
</span><span class="lnt"> 50
</span><span class="lnt"> 51
</span><span class="lnt"> 52
</span><span class="lnt"> 53
</span><span class="lnt"> 54
</span><span class="lnt"> 55
</span><span class="lnt"> 56
</span><span class="lnt"> 57
</span><span class="lnt"> 58
</span><span class="lnt"> 59
</span><span class="lnt"> 60
</span><span class="lnt"> 61
</span><span class="lnt"> 62
</span><span class="lnt"> 63
</span><span class="lnt"> 64
</span><span class="lnt"> 65
</span><span class="lnt"> 66
</span><span class="lnt"> 67
</span><span class="lnt"> 68
</span><span class="lnt"> 69
</span><span class="lnt"> 70
</span><span class="lnt"> 71
</span><span class="lnt"> 72
</span><span class="lnt"> 73
</span><span class="lnt"> 74
</span><span class="lnt"> 75
</span><span class="lnt"> 76
</span><span class="lnt"> 77
</span><span class="lnt"> 78
</span><span class="lnt"> 79
</span><span class="lnt"> 80
</span><span class="lnt"> 81
</span><span class="lnt"> 82
</span><span class="lnt"> 83
</span><span class="lnt"> 84
</span><span class="lnt"> 85
</span><span class="lnt"> 86
</span><span class="lnt"> 87
</span><span class="lnt"> 88
</span><span class="lnt"> 89
</span><span class="lnt"> 90
</span><span class="lnt"> 91
</span><span class="lnt"> 92
</span><span class="lnt"> 93
</span><span class="lnt"> 94
</span><span class="lnt"> 95
</span><span class="lnt"> 96
</span><span class="lnt"> 97
</span><span class="lnt"> 98
</span><span class="lnt"> 99
</span><span class="lnt">100
</span><span class="lnt">101
</span><span class="lnt">102
</span><span class="lnt">103
</span><span class="lnt">104
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="nn">---</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">v1</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ServiceAccount</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nn">---</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ClusterRole</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">rbac.authorization.k8s.io/v1</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nt">rules</span><span class="p">:</span><span class="w">
</span><span class="w"></span>- <span class="nt">apiGroups</span><span class="p">:</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;&#34;</span><span class="w">
</span><span class="w">  </span><span class="nt">resources</span><span class="p">:</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;namespaces&#34;</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;pods&#34;</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;service&#34;</span><span class="w">
</span><span class="w">  </span><span class="nt">verbs</span><span class="p">:</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;get&#34;</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;watch&#34;</span><span class="w">
</span><span class="w">  </span>- <span class="s2">&#34;list&#34;</span><span class="w">
</span><span class="w"></span><span class="nn">---</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ClusterRoleBinding</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">rbac.authorization.k8s.io/v1</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nt">subjects</span><span class="p">:</span><span class="w">
</span><span class="w"></span>- <span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ServiceAccount</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span><span class="w">  </span><span class="nt">apiGroup</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;&#34;</span><span class="w">
</span><span class="w"></span><span class="nt">roleRef</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ClusterRole</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">  </span><span class="nt">apiGroup</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;&#34;</span><span class="w">
</span><span class="w"></span><span class="nn">---</span><span class="w">
</span><span class="w"></span><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">apps/v1</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">DaemonSet</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es-v2.7.0</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">logging</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">    </span><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="l">v2.7.0</span><span class="w">
</span><span class="w">    </span><span class="nt">addonmanager.kubernetes.io/mode</span><span class="p">:</span><span class="w"> </span><span class="l">Reconcile</span><span class="w">
</span><span class="w"></span><span class="nt">spec</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">selector</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">matchLabels</span><span class="p">:</span><span class="w">
</span><span class="w">      </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">      </span><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="l">v2.7.0</span><span class="w">
</span><span class="w">  </span><span class="nt">template</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">      </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">        </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">        </span><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="l">v2.7.0</span><span class="w">
</span><span class="w">      </span><span class="c"># This annotation ensures that fluentd does not get evicted if the node</span><span class="w">
</span><span class="w">      </span><span class="c"># supports critical pod annotation based priority scheme.</span><span class="w">
</span><span class="w">      </span><span class="c"># Note that this does not guarantee admission on the nodes (#40573).</span><span class="w">
</span><span class="w">      </span><span class="nt">annotations</span><span class="p">:</span><span class="w">
</span><span class="w">        </span><span class="nt">seccomp.security.alpha.kubernetes.io/pod</span><span class="p">:</span><span class="w"> </span><span class="s1">&#39;docker/default&#39;</span><span class="w">
</span><span class="w">    </span><span class="nt">spec</span><span class="p">:</span><span class="w">
</span><span class="w">      </span><span class="nt">priorityClassName</span><span class="p">:</span><span class="w"> </span><span class="l">system-node-critical</span><span class="w">
</span><span class="w">      </span><span class="nt">serviceAccountName</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">      </span><span class="nt">containers</span><span class="p">:</span><span class="w">
</span><span class="w">      </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es</span><span class="w">
</span><span class="w">        </span><span class="nt">image</span><span class="p">:</span><span class="w"> </span><span class="l">quay.io/fluentd_elasticsearch/fluentd:v2.7.0</span><span class="w">
</span><span class="w">        </span><span class="nt">env</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">FLUENTD_ARGS</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w"> </span>--<span class="kc">no</span>-<span class="l">supervisor -q</span><span class="w">
</span><span class="w">        </span><span class="nt">resources</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">limits</span><span class="p">:</span><span class="w">
</span><span class="w">            </span><span class="nt">memory</span><span class="p">:</span><span class="w"> </span><span class="l">500Mi</span><span class="w">
</span><span class="w">          </span><span class="nt">requests</span><span class="p">:</span><span class="w">
</span><span class="w">            </span><span class="nt">cpu</span><span class="p">:</span><span class="w"> </span><span class="l">100m</span><span class="w">
</span><span class="w">            </span><span class="nt">memory</span><span class="p">:</span><span class="w"> </span><span class="l">200Mi</span><span class="w">
</span><span class="w">        </span><span class="nt">volumeMounts</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">varlog</span><span class="w">
</span><span class="w">          </span><span class="nt">mountPath</span><span class="p">:</span><span class="w"> </span><span class="l">/var/log</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">varlibdockercontainers</span><span class="w">
</span><span class="w">          </span><span class="nt">mountPath</span><span class="p">:</span><span class="w"> </span><span class="l">/var/lib/docker/containers</span><span class="w">
</span><span class="w">          </span><span class="nt">readOnly</span><span class="p">:</span><span class="w"> </span><span class="kc">true</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">config-volume</span><span class="w">
</span><span class="w">          </span><span class="nt">mountPath</span><span class="p">:</span><span class="w"> </span><span class="l">/etc/fluent/config.d</span><span class="w">
</span><span class="w">      </span><span class="nt">terminationGracePeriodSeconds</span><span class="p">:</span><span class="w"> </span><span class="m">30</span><span class="w">
</span><span class="w">      </span><span class="nt">volumes</span><span class="p">:</span><span class="w">
</span><span class="w">      </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">varlog</span><span class="w">
</span><span class="w">        </span><span class="nt">hostPath</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">path</span><span class="p">:</span><span class="w"> </span><span class="l">/var/log</span><span class="w">
</span><span class="w">      </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">varlibdockercontainers</span><span class="w">
</span><span class="w">        </span><span class="nt">hostPath</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">path</span><span class="p">:</span><span class="w"> </span><span class="l">/var/lib/docker/containers</span><span class="w">
</span><span class="w">      </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">config-volume</span><span class="w">
</span><span class="w">        </span><span class="nt">configMap</span><span class="p">:</span><span class="w">
</span><span class="w">          </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">fluentd-es-config-v0.2.0</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><p>分别创建上面的 ConfigMap 对象和 DaemonSet</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash">kubectl apply -f fluentd-es-configmap.yaml   fluentd-es-ds.yaml
</code></pre></td></tr></table>
</div>
</div><p>Fluentd 启动成功后，可以前往 Kibana 的 Dashboard 页面中，点击左侧的Discover，配置index后即可查看日志。</p>
<h4 id="安装-filebeat">安装 filebeat</h4>
<p>这里，将基于Elastic官方提供的Filebeat部署脚本进行部署：
官方配置文件无法直接使用，需要我们定制。首先，修改DaemonSet中的环境变量env：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="w">   </span><span class="nt">env</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">ELASTICSEARCH_HOST</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;localhost&#34;</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">ELASTICSEARCH_PORT</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w"> </span><span class="s2">&#34;32700&#34;</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">ELASTICSEARCH_USERNAME</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">ELASTICSEARCH_PASSWORD</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">ELASTIC_CLOUD_ID</span><span class="w">
</span><span class="w">          </span><span class="nt">value</span><span class="p">:</span><span class="w">
</span><span class="w">        </span>- <span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">ELASTIC_CLOUD_AUTH</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><p>如上，ELASTICSEARCH_HOST指定为Elasticsearch集群的入口地址，端口ELASTICSEARCH_PORT为默认的9200；由于集群没有加密，因此ELASTICSEARCH_USERNAME和ELASTICSEARCH_PASSWORD全部留空；其他保持默认。</p>
<p>同时，还需要注释掉第一个ConfigMap中output.elasticsearch的用户名和密码：</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span><span class="lnt">2
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="w">      </span><span class="c">#username: ${ELASTICSEARCH_USERNAME}</span><span class="w">
</span><span class="w">      </span><span class="c">#password: ${ELASTICSEARCH_PASSWORD}</span><span class="w">
</span></code></pre></td></tr></table>
</div>
</div><p>其次，还需要修改第二个ConfigMap的data部分为，修改为自身符合的配置，这里根据项目名称添加不同的索引值</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt"> 1
</span><span class="lnt"> 2
</span><span class="lnt"> 3
</span><span class="lnt"> 4
</span><span class="lnt"> 5
</span><span class="lnt"> 6
</span><span class="lnt"> 7
</span><span class="lnt"> 8
</span><span class="lnt"> 9
</span><span class="lnt">10
</span><span class="lnt">11
</span><span class="lnt">12
</span><span class="lnt">13
</span><span class="lnt">14
</span><span class="lnt">15
</span><span class="lnt">16
</span><span class="lnt">17
</span><span class="lnt">18
</span><span class="lnt">19
</span><span class="lnt">20
</span><span class="lnt">21
</span><span class="lnt">22
</span><span class="lnt">23
</span><span class="lnt">24
</span><span class="lnt">25
</span><span class="lnt">26
</span><span class="lnt">27
</span><span class="lnt">28
</span><span class="lnt">29
</span><span class="lnt">30
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-yaml" data-lang="yaml"><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l">v1</span><span class="w">
</span><span class="w"></span><span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l">ConfigMap</span><span class="w">
</span><span class="w"></span><span class="nt">metadata</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l">filebeat-config</span><span class="w">
</span><span class="w">  </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l">kube-system</span><span class="w">
</span><span class="w">  </span><span class="nt">labels</span><span class="p">:</span><span class="w">
</span><span class="w">    </span><span class="nt">k8s-app</span><span class="p">:</span><span class="w"> </span><span class="l">filebeat</span><span class="w">
</span><span class="w"></span><span class="nt">data</span><span class="p">:</span><span class="w">
</span><span class="w">  </span><span class="nt">filebeat.yml</span><span class="p">:</span><span class="w"> </span><span class="p">|-</span><span class="sd">
</span><span class="sd">    filebeat.inputs:
</span><span class="sd">    - type: log
</span><span class="sd">      paths:
</span><span class="sd">        - &#34;/data/log/app/*/*/*.log&#34;
</span><span class="sd">        - &#34;/data/log/app/*/*&#34;
</span><span class="sd">        - &#34;/data/log/app/*&#34;
</span><span class="sd">    output.elasticsearch:
</span><span class="sd">      hosts: [&#39;${ELASTICSEARCH_HOST:localhost}:${ELASTICSEARCH_PORT:32700}&#39;]
</span><span class="sd">      indices:
</span><span class="sd">        - index: &#34;nginx-log-%{+yyyy.MM.dd}&#34;
</span><span class="sd">          when.contains:
</span><span class="sd">            message: &#34;nginx-log&#34;
</span><span class="sd">        - index: &#34;notification-log-%{+yyyy.MM.dd}&#34;
</span><span class="sd">          when.contains:
</span><span class="sd">            message: &#34;notification-log&#34;
</span><span class="sd">        - index: &#34;offer-policy-log-%{+yyyy.MM.dd}&#34;
</span><span class="sd">          when.contains:
</span><span class="sd">            message: &#34;offer-policy-log&#34;
</span><span class="sd">        - index: &#34;core-%{+yyyy.MM.dd}&#34;
</span><span class="sd">          when.contains:
</span><span class="sd">            message: &#34;core-log&#34;</span><span class="w">    
</span></code></pre></td></tr></table>
</div>
</div><p>修改完配置后，可以启动filebeat服务</p>
<div class="highlight"><div class="chroma">
<table class="lntable"><tr><td class="lntd">
<pre class="chroma"><code><span class="lnt">1
</span></code></pre></td>
<td class="lntd">
<pre class="chroma"><code class="language-bash" data-lang="bash">kubectl apply -f filebeat-kubernetes.yaml
</code></pre></td></tr></table>
</div>
</div><p>启动成功后即可在kibana面板中配置添加索引模式，方便阅览。</p>
</div><div id="comments"></div></div></div>
            </main><footer class="footer">
        <div class="footer-container"><div class="footer-line"><i class="far fa-copyright fa-fw"></i><span itemprop="copyrightYear">2019 - 2021</span><span class="author" itemprop="copyrightHolder">&nbsp;<a href="/" target="_blank">mikel pan</a></span>&nbsp;|&nbsp;<span class="license"><a rel="license external nofollow noopener noreffer" href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank">CC BY-NC 4.0</a></span><span class="icp-splitter">&nbsp;|&nbsp;</span><br class="icp-br"/>
                    <span class="icp"><a href="https://beian.miit.gov.cn/" target="_blank">粤ICP备2021047442号</a></span></div>
        </div>
    </footer></div>

        <div id="fixed-buttons"><a href="#" id="back-to-top" class="fixed-button" title="回到顶部">
                <i class="fas fa-arrow-up fa-fw"></i>
            </a><a href="#" id="view-comments" class="fixed-button" title="查看评论">
                <i class="fas fa-comment fa-fw"></i>
            </a>
        </div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/lightgallery.js@1.2.0/dist/css/lightgallery.min.css"><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/smooth-scroll@16.1.3/dist/smooth-scroll.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/autocomplete.js@0.37.1/dist/autocomplete.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/algoliasearch@4.2.0/dist/algoliasearch-lite.umd.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/lazysizes@5.2.2/lazysizes.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/lightgallery.js@1.2.0/dist/js/lightgallery.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/lg-thumbnail.js@1.2.0/dist/lg-thumbnail.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/lg-zoom.js@1.2.0/dist/lg-zoom.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/clipboard@2.0.6/dist/clipboard.min.js"></script><script type="text/javascript" src="https://cdn.jsdelivr.net/npm/sharer.js@0.4.0/sharer.min.js"></script><script type="text/javascript">window.config={"code":{"copyTitle":"复制到剪贴板","maxShownLines":10},"comment":{},"lightGallery":{"actualSize":false,"exThumbImage":"data-thumbnail","hideBarsDelay":2000,"selector":".lightgallery","speed":400,"thumbContHeight":80,"thumbWidth":80,"thumbnail":true},"search":{"algoliaAppID":"REQJX89W85","algoliaIndex":"index.zh-cn","algoliaSearchKey":"63fa048de9b35627f46672e95abc14df","highlightTag":"em","maxResultLength":10,"noResultsFound":"没有找到结果","snippetLength":50,"type":"algolia"}};</script><script type="text/javascript" src="/js/theme.min.js"></script></body>
</html>
